The classic trap
This recital announces a truth many entities overlook: the NIS 2 scope is not frozen. The European Commission periodically reviews annexes I and II, size thresholds and the types of entities covered. An SME outside scope today can become an important entity tomorrow through a simple revision, with no change in its activity. Organisations that manage compliance as a one-off project are systematically caught by the ILR during inspections 18 months after a review, having failed to reassess their qualification.
Signals that should trigger an immediate reassessment
- Publication of a delegated act or Commission review amending annexes I/II.
- Designation of your cloud provider or platform as a very large online platform under the DSA (Article 33 Regulation 2022/2065).
- Crossing a headcount threshold (50 or 250 employees) or turnover threshold (EUR 10M, EUR 50M).
- Acquisition, merger or new activity in a subsector of the annexes (energy, health, digital infrastructure, public administration).
- Publication by ENISA of a new sectoral guide clarifying a previously ambiguous subsector.
- Updates to the ILR list of essential and important operators in Luxembourg.
The Luxgap reflex: do not wait for the audit to discover you have become an essential entity
The classic mistake is to self-assess your scope once, in 2024, and file the dossier away. Yet the ILR notifies new operators without warning, and the deadline to deploy Article 21 NIS 2 measures is short. Structured monitoring of Commission reviews, delegated acts and DSA designations is essential.
How Luxgap automates this risk
Our Luxgap Scope Radar turns the question 'are we still outside NIS 2 scope?' into continuous monitoring that alerts you the day the answer changes. The tool combines an AI agent that monitors in real time the EU Official Journal, Commission delegated acts, ENISA communications and DSA designations, with a direct connector to your HR data (Workday, Sopra Steria HR Suite, Sage BOB 50) and financial data (Odoo, SAP, Cegid Quadra) to continuously recompute your qualification.
- Monitors in real time OJEU publications, Commission reviews and ILR decisions likely to modify annexes I/II or size thresholds.
- Automatically recomputes your qualification (out of scope / important entity / essential entity) at each variation in headcount, turnover or activity perimeter by cross-referencing your HR and ERP systems.
- Detects if one of your critical providers (cloud, SaaS, telecoms) is designated very large online platform under the DSA and assesses the impact on your own indirect qualification.
- Instantly alerts the DPO, CISO and executive management via Teams or email when a signal alters your probable status.
- Produces a timestamped PDF qualification report, opposable to the ILR, documenting your reasoning and the date on which your status evolved.
- Generates a prioritised roadmap of Article 21 measures to deploy if a status change is detected, with effort estimate and realistic schedule.
Available alongside a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free 48-hour blank audit to determine your current qualification and anticipate upcoming reviews.
